Reauthorizing TRIA:

The State of the Terrorism Risk

Insurance Market

United States Senate

Committee on Banking, Housing and

Urban Affairs

Testimony of

Robert P. Hartwig, Ph.D., CPCU

President & Economist

Insurance Information Institute New York, NY

September 25, 2013

Washington, DC

2

Thank you, Senator Johnson, Ranking Member Crapo and members of the Committee.

Good morning. My name is Robert Hartwig and I am President and Economist for the

Insurance Information Institute, an international property/casualty insurance trade

association based in New York City.1 I am also a Chartered Property Casualty

Underwriter (CPCU) and have worked on a wide variety of insurance issues during my

20 years in the property/casualty insurance and reinsurance industries, including many

related to the industry’s exposure to catastrophic loss, including acts or terrorism.2 The

Institute’s members account for nearly 70 percent of all property/casualty insurance

premiums written in the United States. Its primary mission is to improve understanding

of the insurance industry and the key role it plays in the U.S. and global economy.

I have been asked by the Committee to provide testimony on the current state the

Terrorism Risk Insurance Program and the market for terrorism insurance in the United

States. For the purposes of my testimony, I will address the following issues:

(i) The immediate impacts of the September 11, 2001 attacks on insurance and

reinsurance markets;

(ii) The essential role that TRIA plays with the nation’s national security

infrastructure and its benefits to consumers, businesses and communities;

(iii) Taxpayer protection features of TRIA;

(iv) Private sector insurer and reinsurer involvement in terrorism insurance

markets since 9/11;

(v) The unique nature of terrorism risk and the limits of private sector

involvement in terrorism insurance markets;

(vi) Changes in the terrorism threat landscape since the enactment of the original

TRIA legislation in 2002 and the impacts on terrorism insurance;

(vii) Potential economic and insurance market impacts if TRIA is not extended;

(viii) Obstacles to insuring and reinsuring losses arising from acts of terrorism;

(ix) Cyber terrorism and certification timelines. 1 Contact information: Tel: (212) 346-5520; Email: bobh@iii.org. 2 See Terrorism Risk: A Constant Threat, Robert P. Hartwig and Claire Wilkinson, Insurance Information Institute, June 2013.

3

Impacts of the September 11, 2001 Terrorist Attack on Insurance Markets

The terrorist attacks of September 11, 2001, produced insured losses larger than any

natural or man-made event in history. Claims paid by insurers to their policyholders

eventually totaled some $32.5 billion dollars—$42.1 billion in 2012 dollars (Exhibit 1)

and to this day remains the second most costly insurance event in United States history

(Exhibit 2).3 The insured losses arising from the events of that fateful day were

unprecedented in virtually every respect, producing catastrophic losses not only in

property coverages, but also for the first time in the workers compensation line. The

sheer enormity of the loss—coming from an entirely unforeseen peril for which no

premium had been collected—combined with the possibility of future attacks, produced

financial shockwaves that shook insurance markets worldwide and provoked an

extraordinarily swift and severe underwriting and pricing reaction by insurers and

reinsurers.

Terrorism Exclusions and Price Shocks in the Wake of the 9/11 Attack

The shock of the September 11 attack led insurers and reinsurers to exclude coverage

arising from acts of terrorism from virtually all commercial property and liability

policies. Before 9/11 terrorism exclusions were virtually nonexistent in commercial

insurance contracts sold in the United States. The economic consequences of such

exclusions were quick to manifest themselves. Major commercial property construction

projects around the country, unable to secure coverage against the now very real risk of

terrorist attack, were in jeopardy of being tabled, hurting job growth at a time of rapidly

rising unemployment and when much of the country was in recession. Banks, in turn,

threatened to choke off lending to businesses if borrowers failed to secure coverage

against terrorist acts. The problem was not confined to high profile “trophy” properties

located in major metropolitan areas. Shopping malls, office complexes, factories, sports

stadiums, hotels, utilities, airports, port facilities and other critical infrastructure all across

the United States were impacted. In short, the macroeconomic consequences associated

with the lack of terrorism coverage were beginning to exact a severe toll on businesses

3 The loss totals do not include the March 2010 settlement of up to $657.5 million announced by New York City officials and plaintiffs’ lawyers to compensate about 10,000 workers whose health was damaged during the rescue and cleanup at the World Trade Center.

4

and workers alike. [Note: The potential macroeconomic implications of allowing TRIA

to expire in 2014 are discussed in greater detail in the next section of this paper].

Even as exclusions proliferated, prices soared. The average rate increase for a business

seeking to renew coverage in the fourth quarter of 2001 was nearly 30 percent.

Reinsurance prices rose sharply as well. Very little private sector coverage for terrorism

entered the market as a general consensus emerged that terrorism risk is fundamentally

not insurable. Insurers, who are regulated by the states, therefore took the unprecedented

step of seeking to establish a risk sharing plan with the federal government in the event of

future attacks. Only when the Terrorism Risk Insurance Act (TRIA) was enacted by

Congress in November 2002—fourteen months after the attack—did stability finally

return to the market and coverage for terrorist attacks resume.

TRIA, National Security and Protection of the Nation’s Critical Financial

Infrastructure

The war on terror is far from over, as the recent Boston Marathon bombings attest, but

TRIA by all objective measures is now a proven and unqualified success. The program

not only succeeded in restoring stability to the country’s vital insurance and reinsurance

markets in the years immediately following 9/11, but it continues more than a decade

later to deliver substantive, direct benefits to millions of businesses, workers, consumers

and the overall economy—all at essentially no cost to taxpayers.

Upwards of 60 percent of businesses purchased terrorism coverage nationally in 2012, up

from 27 percent in 2003, the first full year of the program (Exhibit 3). Industries

responsible for much of the country’s critical infrastructure such as power and utilities,

telecommunications and health care, along with financial institutions and local

government have take-up rates that approach or exceed 70 percent. Moreover, the take-

up rate for workers compensation is effectively 100 percent, meaning that every worker

in America is protected against injuries suffered as the result of a terrorist attack.

The unambiguous success of TRIA demonstrates that the Act has become an invaluable

component of the country’s national security infrastructure. The continued operation of

5

the nation’s financial institutions—including its insurers—during and throughout the

aftermath of a major terrorist attack—is absolutely essential to ensure a smooth and

expedited recovery from the massive economic and operational shocks of the sort that

occurred after the 9/11 attacks and that are certain to accompany future such events,

irrespective of where in the country they occur. Failure to institutionalize a permanent

plan to protect the nation’s financial infrastructure leaves the country unnecessarily

vulnerable to economic instability and risk of recession.

Macroeconomic Impacts of the TRIA Expiration

A 2004 study co-authored by R. Glenn Hubbard, Columbia University’s Business School

Dean and a former chairman of the U.S. Council of Economic Advisors, quantified the

potential macroeconomic impacts of a failure to extend TRIA.4 The study concluded that

within three years of the expiration of TRIA (in the absence of a major terrorist attack),

GDP could fall by 0.4 percent, household net worth by 0.9 percent and employment by

0.2 percent. Applying the findings of that study to the current period suggests that

expiration of the current Act could lead to a meaningful drag on economic growth,

reducing real GDP by an estimated $69 billion by 2017, depressing household net worth

by an estimated $798 billion and remove 290,000 jobs from the economy.5

Table 1 POTENTIAL MACROECONOMIC IMPACTS ASSOCIATED WITH THE

EXPIRATION OF TRIA

Macroeconomic Factor

Estimated Impact Within 3 Years of

Terrorism Program Expiration

Real GDP -$69 Billion

Household Net Worth -$798 Billion

Jobs -290,000

4 R. Glenn Hubbard and Bruce Deal, The Economic Effects of Federal Participation in Terrorism Risk, Analysis Group, September 14, 2004. 5 Figures cited in Table 1 are Insurance Information Institute estimates based on findings of the study referenced in footnote 3.

6

As Table 1 demonstrates, terrorism remains a threat to the country’s national economic

security, especially in the context of the still fragile economic recovery. Consequently,

maintaining a Terrorism Risk Insurance Program as a component of the country’s

comprehensive national security plan and infrastructure is both reasonable and prudent. It

is also imminently affordable. Indeed, the cost to American taxpayers is effectively zero.

Taxpayer Protection Features of the Terrorism Risk Insurance Act

TRIA from its inception was designed as a terrorism risk sharing mechanism between the

public and private sector—with an overwhelming share of the risk being borne by private

insurers, a share which has increased steadily over time. Today, all but the very largest

(and least likely) terrorist attacks would be financed entirely within the private sector. In

the event of a truly catastrophic attack, TRIA provides the government with the ability to

fully recoup any and all federal monies paid. In other words, there would be no cost to

the taxpayer.

As a point of fact, from the date of TRIA’s enactment in November 2002 through today,

a span of nearly 11 years, the federal government and therefore taxpayers have paid

nothing (apart from negligible administrative expenses) under the program. The recent

Boston Marathon bombings provide an illustrative example. All of the 207

property/casualty claims filed in the wake of that event were handled by private insurers

who have made payments to policyholders totaling at least $1.18 million.6 Not one

taxpayer dollar was used to pay any of these claims.

TRIA’s structure actually provides at least eight distinct layers of taxpayer protection as

displayed schematically in Exhibit 4’s Pyramid of Taxpayer Protection. Each of those

layers is discussed in turn below.

6 As of July 26 (latest available). P/C insurers also held $1.41 million in reserves for claims associated with the bombings. Figures are from the Massachusetts Division of Insurance as reported in BestWire Services, P/C Insurers Have Paid $1.18 Million in Boston Marathon Bombing Related Claims, September 3, 2013.

7

SUMMARY OF 8 KEY TAXPAYER PROTECTION

FEATURES UNDER TRIA

1. CERTIFICATION DEFINITION: Criteria Must Be Met7 Definition of a Certified Act of Terrorism: The 2007 extension of

TRIA, likes its predecessors, requires that a detailed set of criteria be met before an act of terror can be “certified.” Specifically, the term “act of terrorism” refers only to an act that is certified by the [Treasury] Secretary, in concurrence with the Secretary of State and the Attorney General of the United States:

i. to be an act of terrorism; ii. to be a violent act or an act that is dangerous to human life,

property or infrastructure; iii. to have resulted in damage within the United States, or outside of

the United States in the case US air carriers, vessels and/or missions;

iv. to have been committed by and individuals as part of an effort to coerce the civilian population of the United States or to influence the policy or affect the conduct of the US government by coercion.

2. CERTIFICATION THRESHOLD (TRIGGER): $5 Million

$5 Million Minimum: Under the 2007 reauthorization of TRIA, no act shall be certified by the Secretary as an act of terrorism if property and casualty losses, in the aggregate, do not exceed $5 million.

Acts of War Exclusion: TRIA further stipulates that no act may be certified as an act of terrorism if the act is committed as part of the course of a war declared by Congress (this provision does not apply to workers compensation).

3. TRIGGERING EVENT THRESHOLD: $100 Million Under the 2007 reauthorization of TRIA the triggering event threshold

was set at $100 million, up from $5 million in the original act and $50 million in 2006. This means that Federal funds will be paid out only in the event of a terrorist act that produces total insurance industry losses above this threshold (even if the event is certified by the Treasury Secretary as a terrorist act).

7 United States Treasury accessed as of 9/22/13 at http://www.treasury.gov/resource-center/fin-mkts/Documents/TRIAasamended-CompositeTextPost.pdf.

8

4. INDIVIDUAL INSURER DEDUCTIBLES: 20% of Premiums The amount of terrorism losses that an individual insurer must pay before

federal assistance becomes available. The level rose to 20 percent of an insurer’s direct earned premiums for commercial property/casualty insurance in 2007 where it currently remains (up from 17.5% in 2006, 15 percent in 2005, 10% in 2004 and 7% in 2003).

5. INSURER CO-PAYMENT IN EXCESS OF RETENTION: 15% of Loss The share of losses that insurers pay above their individual retentions rose

to 15 percent in 2007 where it remains today, up from 10 percent in 2006 and prior years.

6. INDUSTRY AGGREGATE RETENTION: $27.5 Billion

Under the 2007 reauthorization, the industry as a whole must ultimately cover a total of $27.5 billion of the losses through deductibles and copayments (assuming an event of $27.5 billion or greater). This amount was increased to $27.5 billion in 2007, up from $25 billion in 2006, $15 billion in 2005, $12.5 billion 2004 and $10 billion in 2003 (Figure 7). Government expenditure above this amount can be recouped.

7. GOVERNMENT RECOUPMENT: Full Taxpayer Protection Mandatory Recoupment: TRIA mandates that the government recoup

133 percent of the difference between the actual amount it has paid and the required retention. This recoupment comes via a surcharge on commercial insurance policyholders not to exceed 3 percent of premium for insurance coverages that fall under the program.

Discretionary Recoupment: If the insured loss exceeds the $27.5 billion threshold, federal expenditures may be recouped for amounts in excess of the threshold at the discretion of the Secretary of the Treasury.

8. HARD CAP: $100 Billion Program Limit: Losses within a program year are capped at $100

billion, inclusive of both insurer and government participation. Neither the government nor insurers would be required to pay losses for certified acts beyond this amount.

9

Additional Taxpayer Protection Features of TRIA

Several other features of TRIA serve as additional protections to taxpayers.

Commercial Lines Only: Only claims occurring in certain property/casualty commercial

lines of insurance are included in the calculations of insured losses under TRIA (auto and

homeowners insurance, life insurance and health insurance have always been excluded).

In addition, the number of lines covered under TRIA has been narrowed over time. At

TRIA’s inception in 2002 approximately 44 percent of property/casualty insurance

industry premiums were covered under the Act. By 2012 that figure had dropped to

approximately 35 percent. Excluded commercial lines of coverage under the Act today

include: mortgage and title insurance, financial guaranty, medical malpractice,

reinsurance, commercial auto, burglary and theft, surety, professional liability (except

directors and officers coverage) and farmowners multiperil.

State Guaranty Funds: In the unlikely event that an insurer becomes severely impaired

or insolvent as a consequence of a terrorist attack, state insurance regulators will take

corrective action. If the insurer’s assets are insufficient to meet its liabilities, the

resources of the appropriate state guaranty fund(s) could be called upon to satisfy those

liabilities. Guaranty associations obtain funds for their operations and payment of claims

through assessments against the solvent insurance companies licensed to do business in

the state and from the recovery of amounts paid on claims from the insolvent estate.8 All

guaranty fund resources are therefore ultimately derived from the industry itself. No

taxpayer dollars are ever involved.

Make Available Requirement (Mandatory Offer of Coverage): Commercial insurers

are required to offer coverage against terrorist acts and by law, workers compensation

must include coverage against such acts. These requirements have led to widespread

participation in the program. The take-up rate for terrorism coverage in 2012 was 62

8 National Conference of Insurance Guaranty Funds accessed September 22, 2013 at: http://www.ncigf.org/media/files/Primer-2012.pdf

10

percent according to a recent study by insurance broker Marsh.9 The take-up rate for

workers compensation is effectively 100 percent, meaning that every worker in America

is protected against injuries suffered as the result of a terrorist attack.

TRIA Will Reduce Taxpayer Funded Post-Attack Disaster Aid Costs

The very fact that terrorism coverage is so widely purchased today and that coverage

already extends to every American worker through the workers compensation system

means that fewer government (taxpayer) resources will be called upon in the wake of any

future terrorist attack. Allowing TRIA to expire will reduce the market penetration of

terrorism coverage as prices rise and insurers limit their exposure across all lines of

coverage, including workers compensation. Consequently, the uninsured share of losses

will rise, increasing the pressure on the government to compensate victims for their

uninsured losses. This will impair the ability of individual businesses, affected

communities and the overall economy’s ability to recover. A sharp spike in business

failures, higher unemployment and reduced GDP growth are just a few of the adverse

consequences that are certain to follow in the event of a major terrorist attack in the

absence of TRIA. In summary, government will be called upon to act in the aftermath of

a major terrorist attack. TRIA provides an efficient means for ensuring that most of the

costs are financed and administered by the private sector rather than the taxpayer.

Use of Insurer Claim Management Infrastructure Will Save Taxpayer Money,

Improve Post-Attack Response

Private insurers are today the principal source and conduit for the rapid and direct

delivery of recovery funds to victims of terrorist attacks. In the event that TRIA is

allowed to expire, the government lacks any formal structure or experience for adjusting,

managing and delivering benefits to victims of complex commercial property and

liability claims, nor does it have any formal fraud monitoring capability. Maintaining

TRIA not only ensures that the costs of future terrorist attacks will be borne primarily by

the private sector, it enhances the quality of the outcome. Again, in the absence of TRIA

there is no question that the federal government will be called upon to act. TRIA ensures

that that much of those costs will be borne and administered by the private insurers. 9 Marsh, 2013 Terrorism Risk Insurance Report, May 2013.

11

Private Insurer and Reinsurance Participation in the Market for Terrorism

Insurance Today

One primary goal of TRIA and it successors has been to encourage private sector

capacity to enter (and remain) in the marketplace so that an increasing share of losses

from future terrorist attacks could be borne in the private sector.

There is no question that billions of dollars in capacity has been attracted to the terrorism

risk insurance market. Evidence of the program’s success in this respect has been

documented by a number of government entities and other organizations. In its latest

report on terrorism risk insurance market conditions, the President’s Working Group on

Financial Markets noted that the program provides an incentive to property/casualty

insurers and reinsurers who might not otherwise provide terrorism insurance at current

capacity levels or prices.10 The U.S. Government Accountability Office (GAO),

commenting on the availability and affordability of terrorism coverage in large

metropolitan areas, reported that with a few exceptions, commercial property terrorism

insurance appears to be available nationwide at rates policyholders believe is reasonable,

suggesting ample capacity.11

Note that this statement is very different from an assessment that such capacity would

exist in the absence of a terrorism backstop. Again, it is important to emphasize that the

majority of the coverage that exists in the market today exists because of the continued

existence of the Terrorism Risk Insurance Program. Insurance broker Aon estimates that

70% to 80% of the market would encounter terrorism exclusions if the program were

discontinued. Thus capacity in the market is largely contingent upon the continuation of

the program. As detailed earlier in this testimony, policy language that would exclude

coverage against terrorist attacks returned to the market each time the expiration of TRIA

has loomed.

10 Market Conditions for Terrorism Risk Insurance 2010, Report of the President’s Working Group on Financial Markets. 11 Initial Results on Availability of Terrorism Insurance in Specific Geographic Markets, GAO-08-919R, July 2008.

12

The so-called market for “standalone” terrorism coverage also provides evidence that in

the absence of a Terrorism Risk Insurance Program, coverage capacity (supply) will fall

well short of demand. Insurance brokers Marsh and Aon both report that the “theoretical”

maximum amount of coverage available per risk in the “standalone” market is

approximately $2 billion with larger sums available under some circumstances. This is in

contrast with limits of just $150 million or less available in early 2002 before TRIA was

enacted. At the time, such coverage also was subject to high deductibles equal to 7 to 10

percent of the stated value of the coverage.12 While the sums available in the market

today may seem large, especially in comparison to 2002, there are many risks for which

the coverage is inadequate. Consider, for example, that back in 2001 (prior to the

introduction of terrorism exclusions) the twin towers at the World Trade Center site were

insured for $3.55 billion—more than what is generally available in the market today.

Multibillion dollars risks are now quite common in the United States, from office and

shopping complexes to large manufacturing facilities, sports stadiums, transportation

hubs and energy infrastructure not to mention infrastructure such as bridges, tunnels and

dams. These exposures exist in every state.

Reinsurance capacity, which was extremely limited in the aftermath of 9/11, is up as

well. A 2011 report from reinsurance broker Guy Carpenter noted that there is between

$6 billion and $8 billion of terrorism reinsurance capacity available in the U.S. market,

but cautions that the market remains vulnerable to a major terrorism loss. The $6 billion

to $8 billion in terrorism reinsurance capacity stands in stark contrast to approximately

$100 billion in reinsurance capacity available in the market today against traditional risks

(mostly property catastrophe risks). A continued cautious approach is clearly required.

Indeed, many modeled terrorism loss scenarios result in insured losses in the tens or even

hundreds of billions of dollars—some even exceeding the claims paying capital of the

entire industry. As noted previously, much of the capacity in the market today is

predicated on the existence of the Terrorism Risk Insurance Program. In the absence of

the program, reinsurance capacity would be greatly reduced.

12 September 11, 2001: One Hundred Minutes of Terror that Changed the Global Insurance Industry Forever, Robert P. Hartwig, John Liner Review, January 2002.

13

Capital Markets and Terrorism Risk

Capital markets are playing an increasingly important role in providing capacity against

losses arising from large natural disaster events which are becoming increasingly

frequent in the United States and around the world. Capital market reinsurance capacity

for U.S. natural catastrophe risks is estimated at $30 billion to $40 billion. However,

investor appetite for catastrophe risk is so far limited to natural catastrophes such as

hurricanes and earthquakes. Investors are attracted to investments in backing natural

disasters risks in part because the performance of these assets is entirely uncorrelated

with the performance of traditional financial market instruments such as stocks and

bonds. A recession, for example, will impact the value of stocks and corporate bond

prices but will have no impact on the likelihood of sustaining a loss on a catastrophe

bond.

Investors to date have shown no appetite for terrorism risk because in the event of a

major terrorist attack the performance of securitized terrorism risk instruments (such as

catastrophe bonds) and tradition equity market and fixed income investment vehicles are

likely to be highly correlated. For example, a large-scale terrorist attack could cause

bonds exposed to the event to lose all or part of their value, leading to large losses for

investors while stock markets plunge (as they did in the wake of the September 11, 2001

attack). Investor disinterest in terrorism risk is also a function of the inability to model

and therefore price) such risks with anything close to the same degree of precision as

tradition natural disaster risk.

Changes in the Terrorism Threat Landscape and Impacts on Terrorism Insurance

Markets

In the immediate aftermath of 9/11 the ability of commercial policyholders to purchase

adequate limits of terrorism coverage at affordable prices was severely constrained.

Commercial property owners and businesses were faced with substantially reduced

protection for terrorism-related risks, in addition to higher property/casualty rates overall.

As a result, many were forced to go without coverage or only partly insure their assets.

14

Today, reports of property owners having problems securing terrorism coverage due to a

lack of capacity in the market are no longer making headline news. Indeed, it is therefore

tempting to conclude that in the eleven years since TRIA was first implemented that

insurance markets have fully adjusted to the post-9/11 environment and that insurers and

reinsurers have concluded that terrorism is a fully insurance risk.

The reality is quite different. The fact of the matter is that terrorism risk today is almost

every bit as uninsurable as it was a decade ago. Recent major successes in the war on

terror, including the killing of al-Qaida leader Osama bin Laden in 2011, do not alter this

conclusion. This is because the current stability in the terrorism insurance market in the

United States is due almost entirely to two factors:

(i) There has been no successful large scale terrorist attack on U.S. soil since

2001, and

(ii) TRIA remains in place.

The influence of both of these factors is discussed in the sections that follow.

Absence of Successful Attacks Does Not Imply Terrorism Risk is Inconsequential

The fact that there has been no successful terrorist attack in the United States in eleven

years is a remarkable achievement. It is a testimony to the hard work and dedication of

this nation’s counterterrorism agencies and the bravery of the men and women in uniform

who fought and continue to fight battles abroad to keep us safe here at home.

Unfortunately, the threat from terrorist attack in the United States is both real and

substantial and will remain as such for the foreseeable future. Indeed, the U.S. State

Department warned in a recent report that despite the death of bin Laden and other key

al-Qaeda figures, the terrorist network’s affiliates and adherents remain adaptable and

resilient, and constitute “an enduring and serious threat to our national security.”13

13 Country Reports on Terrorism 2011, U.S. Department of State, July 31, 2012.

15

Table 2 below shows that interest in attacking targets within the United States remains

undiminished—with four terrorist plots executed or interdicted within the past year alone.

Indeed, it is clear from Table 2 that in addition to an ongoing threat from foreign terrorist

networks, the United States also faces homegrown (domestic) terrorist threats from

radical individuals, who may be inspired by al-Qaida and others, but may have little or no

actual connection to militant groups.

Catastrophe modeler Risk Management Solutions (RMS) points to an increase in the

number of homegrown plots in the U.S. in recent years.14 Many of these have been

thwarted, such as the 2012 attempt by Quazi Ahsam Nafis to blow up the Federal Reserve

Bank of New York and Mohamed Osman Mohamud who targeted a Portland, Oregon,

Christmas tree lighting ceremony. Also among the more notable unsuccessful attacks was

an April 2013 attempt to blow up an Amtrak train en route between New York and

Toronto. Other thwarted attacks against passenger and cargo aircraft, including the

Christmas Day 2009 attempt to blow-up a jet over Detroit, are indicative of an ongoing

risk to aviation infrastructure.

Table 2 also shows that terrorists are interesting in attacking targets across the United

States, not just in large urban areas. Cities such as Springfield, Illinois and Lubbock,

Texas, have also been targeted. It also important to note that the largest act of domestic

terrorism in United States history was the truck bombing of the Alfred P. Murrah Federal

Building in Oklahoma City in April 1995, which killed 166 people and produced insured

property losses totaling $189 million (in 2012 dollars).

Another evolving threat is cyber-terrorism. Recent high profile attacks, such as the

sabotaging of Iran’s nuclear program via the Stuxnet computer worm and malicious

infiltration attempts here in the U.S. by foreign entities, underscore the growing threat to

both national security and the economy.

All these factors suggest that terrorism risk will be a constant and evolving threat for the foreseeable future.

14 RMS Terrorism Risk Briefing, July 2012.

16

Table 2

RECENT TERRORIST ATTACKS AND ATTEMPTS IN THE UNITED STATES

Date Location Event

April 15, 2013 Boston, MA Brothers Tamerlan and Dzhokhar Tsarnaev detonate two pressure cooker bombs near the finish line of the Boston Marathon, killing 3 and injuring 264

April, 2013 New York City, NY-Toronto

Two suspects with al-Qaida links arrested in Toronto, Canada for alleged plot to blow up Amtrak passenger train en route from New York City to Toronto

November, 2012 New York City, NY Brothers Raees Alam Qazi and Sheheryar Alam Qazi arrested and charged with conspiring to detonate a weapon of mass destruction targeting a New York City landmark

October, 2012 New York City, NY Quazi Mohammad Rezwanul Ahsan Nafis arrested in plot to blow up Federal Reserve Bank in New York City

August, 2012 Ludowici, GA Four U.S. soldiers charged in connection with murder and illegal gang activity, linked to foiled plot to commit domestic acts of terrorism, including overthrowing the government and assassinating the President

May, 2012 TBD Foiled underwear bomb plot to bring down U.S.-bound commercial airliner around the anniversary of bin Laden’s death

July 27, 2011 Fort Hood, TX U.S. Army Pfc Naser Jason Abdo arrested and charged with plotting bomb attack on fellow soldiers at Fort Hood

June 22, 2011 Seattle, WA Two men arrested in plot to attack military recruiting station in Seattle

May 11, 2011 New York City, NY Ahmed Ferhani and Mohamed Mamdouh arrested in plot to attack Manhattan synagogue.

February 23, 2011 Lubbock, TX Foiled plot to bomb military and political targets, including former President George W. Bush in New York, Colorado and California

December 8, 2010 Baltimore, MD Attempted bombing of Armed Forces recruiting center by U.S. citizen Antonio Martinez, aka Muhammad Hussain

November 26, 2010 Portland, OR Attempted bombing at Christmas tree lighting ceremony in downtown Portland by naturalized U.S. citizen Mohamed Osman Mohamud

October, 2010 Washington, D.C. Attempted plot to bomb D.C.-area metro stations

May 1, 2010 New York City, NY Attempted SUV bombing in Times Square, New York City, by naturalized U.S. citizen Faisal Shahzad

December 25, 2009 Over Detroit, MI Attempted bombing of Northwest Airlines passenger jet over Detroit by underwear bomber Umar Farouk Abdulmutallab

September, 2009 New York City, NY U.S. resident Najibullah Zazi and others charged with conspiracy to use weapons of mass destruction in New York City

September, 2009 Springfield, IL Attempted plot to detonate a vehicle bomb at the federal building in Springfield.

September, 2009 Dallas, TX Attempted bombing of skyscraper in Dallas

May, 2009 New York City, NY Foiled plot to bomb Jewish synagogue and shoot down military planes in New York City

May, 2009 Various U.S. targets Conviction of Liberty City six for conspiring to plan attacks on U.S. targets, including Sears Tower, Chicago

Source: Federal Bureau of Investigation (FBI); various news reports; Insurance Information Institute.

17

Potential Impacts If TRIA Is Not Extended

Without question, TRIA and its successors are the principal reason for the continued

stability in the insurance and reinsurance market for terrorism insurance today. As

discussed previously, TRIA is credited with restoring terrorism coverage in commercial

insurance policies upon its enactment in late 2002.

Potential macroeconomic effects of allowing TRIA to expire—reduced economic growth

and fewer jobs—were discussed earlier. In terms of impacts on insurance markets there is

no question that coverage will become more expensive and less available—and in many

cases unavailable. The question is not a theoretical one. In 2004, more than a year

before the original Act’s expiration at year-end 2005, terrorism exclusions once again

emerged for policies with exposure extending into 2006. This was an unmistakable

indication that insurance and reinsurance markets felt that terrorism risk, at least for

larger scale attacks, remained uninsurable in the private sector. After Congress agreed to

extend the program for another two years under the Terrorism Risk Insurance Extension

Act of 2005 (TRIEA), terrorism coverage remained available and affordable in the

market. However, with TRIEA’s looming expiration in year-end 2006, terrorism

exclusions once again appeared in the market, signaling the market’s assessment that

terrorism risk remained fundamentally uninsurable. These exclusions largely disappeared

following passage of a 7-year extension of the program under the Terrorism Risk

Insurance Program Reauthorization Act of 2007 (TRIPRA). With TRIPRA’s expiration

now a little more than one year away (year-end 2014), it is virtually certain that terrorism

exclusions will soon reappear in the market. Indeed, insurance broker Aon estimates that

at least 80 percent of the commercial property market will be impacted by these

exclusions and other restrictions.

Studies by various organizations, including the University of Pennsylvania’s Wharton

School Risk Center, the RAND Corporation and the Organization for Economic Co-

operation and Development (OECD), have supported the idea of a substantive federal

role in terrorism insurance. In particular, the Wharton School found that TRIA has had a

positive effect on availability of terrorism coverage and also has significantly contributed

18

to reducing insurance premiums.15 The OECD notes, however, that the financial (capital)

markets have thus far shown little appetite for terrorism risk.

Evidence from Other Countries: Terrorism Risk Insurance Programs Abroad

Additional evidence that terrorism risk is fundamentally uninsurable comes from abroad.

A number of countries have established their own terrorism risk insurance programs and

these have operated successfully, often for many years. Australia, Austria, Belgium,

France, Germany, the Netherlands, Spain, Switzerland and the United Kingdom have all

created programs to cover terrorism in the event of an attack on their own soil.16 None of

these countries is considering the discontinuation of its program.

This begs the question as to why—twelve years after the 9/11 attack and a decade after

the initial terrorism risk insurance program legislation was enacted—terrorism risk,

particularly for large-scale attacks, is still viewed as uninsurable? The answer is

surprisingly simple and explains why even the absence of a successful major attack on

U.S. soil since 2001 does not alter this assessment.

Obstacles to Insuring Losses Arising from Acts of Terrorism

Simply put, acts of terror violate all four of the basic requirements traditionally associated

with insurability of a risk. In situations where these requirements cannot be met, it is

difficult or impossible to ascertain the premium to be charged and/or difficult or

impossible to achieve the necessary spread of risk to avoid excessive exposure to

catastrophic loss, thereby threatening the insurer’s solvency. Consequently, such a risk

would generally be deemed to be commercially not viable (i.e., insurable) in whole or in

part.

15 Evaluating the Effectiveness of Terrorism Risk Financing Solutions, Howard C. Kunreuther and Erwann O. Michel-Kerjan, September 2007, National Bureau of Economic Research. 16 In 1993, the British government formed a mutual reinsurance pool for terrorist coverage following acts of terrorism by the Irish Republican Army. Insurance companies pay premiums at rates set by the pool. The primary insurer pays the entire claim for terrorist damage but is reimbursed by the pool for losses in excess of a certain amount per event and per year based on its share of the total market. Following 9/11, coverage was extended to cover all risks, except war, including nuclear and biological contamination, aircraft impact and flooding, if caused by terrorist attacks. The British government acts as the reinsurer of last resort, guaranteeing payments above the industry retention.

19

The four basic requirements for insurability of a risk are detailed below (as well in

Exhibits 4A and 4B), with a description of how terrorism risk violates each requirement:

1. Estimable Frequency: Insurers require a large number of observations to

develop predictive, statistically sound rate-making models (an actuarial concept

known as “credibility”). For example, insurers handle millions of auto, home,

workers compensation and business property claims every year, providing them

with vast amounts of data from which they can reliably estimate the frequency of

such claims. For major catastrophic risks such as hurricanes and earthquakes that

occur less frequently insurers still maintain databases with hundreds or even

thousands of these events, supplemented by sophisticated catastrophe models, that

help provide statistically reliable estimates of frequency. Terrorism risk is clearly

different in this respect.

Obstacle: There are very few data points on which to base frequency estimates

for acts of terror in the United States, thus estimates lack any true actuarial

credibility. The opinions of experts on the likelihood of terrorist attacks, which

might be viewed by some as substitutes for actuarially credible data, are also

highly subjective. At any given time, there is a wide range of viewpoints among

national security experts on the likelihood, location and/or attack modality.

Moreover, insurers have no access to data used internally by counterterrorism

agencies. Given the paucity of historical data and diversity and shifting nature of

expert opinions, catastrophe models used to estimate terrorism risk are relatively

undeveloped compared to those used to assess natural hazard risks. The bottom

line is that estimating the frequency of terror attacks with any degree of accuracy

(credibility) is extraordinarily challenging, if not impossible in many

circumstances.

2. Estimable Severity: Insurability requires that the maximum possible/probable

loss be estimable in order to calculate the insurer’s exposure (in dollar terms) and

minimize its “probability of ruin.” No insurer can expose itself to losses of a

magnitude that present an unreasonable risk of insolvency.

20

Obstacle: Potential losses arising from terrorist attacks are virtually unbounded.

In this sense terrorism risk is akin to war risk, which is almost universally

excluded from commercial insurance policies worldwide. Consequently, losses

arising from acts of terror can easily exceed an insurer’s claims paying capital

resources. Workers compensation coverage, which does not permit any

exclusions or limitation if injuries or deaths arise from terrorist acts, can lead to

extreme losses that on their own could potentially bankrupt an insurer under some

attack scenarios. In addition, when it comes to estimating losses from potential

terrorist attacks there also appears to be significant variability in outcomes (i.e.,

disagreement on estimated severity impacts), underscoring the degree of

uncertainty associated with potential terrorist attacks.

3. Diversifiable Risk: Insurability requires that the losses can be spread across a

large number of risks. This is an application of the “Law of Large Numbers” and

helps makes losses more manageable and less volatile. Failure to achieve an

adequate spread of risk increases the risk of insolvency in the same way that an

undiversified portfolio of stocks (or any asset) is riskier than a well-diversified

portfolio.

Obstacle: Terrorism attacks are likely to be highly concentrated geographically

(e.g., World Trade Center site), concentrated within an industry (e.g., power

plants, airports) or within a certain span of time (e.g., coordinated attack).

4. Random Loss Distribution/Fortuity: Insurability requires that the probability of

a loss occurring be random or fortuitous. This implies that individual events must

be unpredictable in terms of timing, location and magnitude.

Obstacle: Terrorism attacks are planned, coordinated and deliberate acts of destruction.

Again, they are likely to be highly concentrated geographically (e.g., World Trade Center

site) or concentrated within an industry (e.g., power plants). Terrorists engage in

“dynamic target shifting” whereby terrorists shift from “hardened targets” to “soft

21

targets” which implies that losses are not random or fortuitous in nature. The April 2013

Boston Marathon bombing was an example of an attack on a soft target. It is also not

difficult to imagine attacks occurring in the United States similar to the September 2013

attack on an upscale shopping mall (another soft target) in Nairobi, Kenya, by al-

Shabaab, a Somali-based terrorist group with links to al-Qaeda.

Additional Issues for Consideration in Conjunction with TRIA Reauthorization

Certification Deadline: While TRIA spells out a highly detailed set of criteria that must

be met for an event to be officially certified as a “terrorist act,” TRIA offers no timeline

or deadline by which such a certification must be made. Although the Boston Marathon

bombings occurred more than five months ago (on April 15, 2013), there has to date been

no certification by the Treasury Department nor has there been any statement by Treasury

that the event would not be certified. Indeed, Treasury has offered no guidance as to

whether any such determination is ever forthcoming. This situation has created some

uncertainty and confusion for policyholders, insurers and other impacted parties. A

simple and reasonable solution would be to require that a certification determination must

be made within a specified number of days after the event.

Cyber Terrorism: The threat both to national security and the economy posed by cyber

terrorism is a growing concern for governments and businesses around the world, with

critical infrastructure, such as power plants, transportation, and communication

infrastructure at risk.17 The Department of Homeland Security received reports of some

198 attacks on critical infrastructure systems in the U.S. in 2012, a 52 percent increase on

2011.18

Former U.S. Homeland Security Secretary Janet Napolitano recently warned that a

“cyber 9/11” could happen imminently and noted that critical infrastructure – including

water, electricity and gas – is very vulnerable to such a strike.19

17 Cyber Risks: The Growing Threat, Robert P. Hartwig and Claire Wilkinson, Insurance Information Institute, April 2013. 18 As Hacking Against U.S. Rises, Experts Try to Pin Down Motive, the New York Times, March 3, 2013 19 Napolitano warns of risk of major cyber attack, Newsday, January 24, 2013.

22

Earlier, in an October 2012 speech then U.S. Defense Secretary Leon Panetta warned that

the United States was facing a possible “cyber Pearl Harbor” scenario, and increasingly

vulnerable to foreign cyber attacks on its critical infrastructure networks. Such attacks are

targeting the computer control systems that operate chemical, electricity and water plants

and transportation networks, Panetta said.

Summary

In the twelve years since the tragedy of the September 11, 2001 terrorist attack on the

United States, much has been learned about the nature of terrorism risk and its

insurability. There is no question that the Terrorism Risk Insurance Act and its

successors brought much needed stability to the market in the aftermath of the most

costly insurance loss in global history. In the decade since, private sector insurers,

reinsurers and the federal government have successfully partnered with one another in

order to maintain that stability, providing tangible benefits for businesses large and

small—and their employees—all across America.

The looming expiration of the TRIA at the end of 2014 brings to a head the question of

whether terrorism risk is now, or ever will be, a risk that can be managed entirely within

the private sector. The evidence, both in the United States and from similar programs

abroad, is that market stability in terms of both pricing and availability of terrorism

coverage, as well as the ability to maintain adequate and expanding levels of capacity

over time, are contingent on the continued existence of the Terrorism Risk Insurance

Program.

Thank you for you for the opportunity to testify before the Committee today. I would be

happy to respond to any questions you may have.

23

Life$1.3 (3%)

Aviation Liability

$4.5 (11%)

Other Liability $5.2

(12%)

Biz Interruption $14.2 (33%)

Property -WTC 1 & 2* $4.6 (11%) Property -

Other$7.8 (19%)

Aviation Hull$0.6 (2%)

Event Cancellation

$1.3 (3%)Workers Comp

$2.3 (6%)

Total Insured Losses Estimate: $42.1B*Loss total does not include March 2010 New York City settlement of up to $657.5 million to compensate approximately 10,000 Ground Zero workers or any subsequent settlements.

Source: Insurance Information Institute.

Loss Distribution by Type of Insurancefrom Sept. 11 Terrorist Attack ($ 2012)

($ Billions)

Exhibit 1

11

Top 10 Most Costly Disastersin U.S. History

(Insured Losses, 2012 Dollars, $ Billions)

$23.9 $25.6

$42.1$48.7

$18.8$13.4$11.1$9.2$8.7$7.8

$0

$10

$20

$30

$40

$50

$60

Hugo (1989)

Ivan (2004)

Charley(2004)

Wilma(2005)

Ike (2008)

Sandy(2012)

Northridge(1994)

Andrew(1992)

9/11Attack*(2001)

Katrina(2005)

* Insured loss estimate for Sep. 11 terrorist attack includes property, business interruption, workers comp, aviation hull, liability, event cancellation and life insurance losses.Sources: PCS; Insurance Information Institute inflation adjustments to 2012 dollars using the CPI.

9/11 is the 2nd

costliest event in US insurance history

Exhibit 2

24

12

Terrorism Insurance Take-up Rates,By Year, 2003-2012

Source: Marsh Global Analytics, 2013 Terrorism Risk Insurance Report, May 2013.

27%

49%

58% 59% 59% 57%61% 62% 64% 62%

0%

10%

20%

30%

40%

50%

60%

70%

80%

2003 2004 2005 2006 2007 2008 2009 2010 2011 2012

In 2003, the first year TRIA was in effect, the terrorism take-up rate was 27 percent. Since then, it has increased steadily, remaining in the

low 60 percent range since 2009.

Exhibit 3

Industry AggregateRetention: $27.5 Bill

Hard Cap$100 Bill

Government Recoupment

Insurer Co-Payments15% Above Retention

Individual Insurer Retention20% of Premiums EarnedProgram Dollar Threshold

$100 MillionCertification Dollar Threshold

$5 Million

Certification of Terrorist Act: Definition Must Be Met

Pyramid of Taxpayer Protection:Strong, Stable, Sound and Secure

Exhibit 4

25

Terrorism Violates Traditional Requirements for InsurabilityRequirement Definition ViolationEstimableFrequency

•Insurance requires largenumber of observations todevelop predictive rate-making models (an actuarialconcept known as credibility)

•Very few data points•Terror modeling still ininfancy, untested.•Inconsistentassessment of threat

EstimableSeverity

•Maximum possible/ probableloss must be at leastestimable in order to minimize“risk of ruin” (insurer cannotrun an unreasonable risk ofinsolvency though assumptionof the risk)

•Potential loss isvirtually unbounded.•Losses can easilyexceed insurer capitalresources for payingclaims.•Extreme risk inworkers compensationand statute forbidsexclusions.

Source: Insurance Information Institute

Exhibit 5A

Requirement Definition ViolationDiversifiableRisk

•Must be able tospread/distribute riskacross large number ofrisks•“Law of LargeNumbers” helps makeslosses manageable andless volatile

•Losses likely highly concentrated geographically or by industry (e.g., WTC, power plants)

RandomLossDistribution/Fortuity

•Probability of lossoccurring must bepurely random andfortuitous•Events are individuallyunpredictable in termsof time, location andmagnitude

•Terrorism attacks are planned, coordinated and deliberate acts of destruction•Dynamic target shifting from “hardened targets” to “soft targets”•Terrorist adjust tactics to circumvent new security measures•Actions of US and foreign govts. may affect likelihood, nature and timing of attackSource: Insurance

Information Institute

Terrorism Violates Traditional Requirements for Insurability (cont’d)

Exhibit 5B